Vulnerability Description
An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution.
CVSS Score
7.2
HIGH
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Syncope | >= 2.0.0, <= 2.0.11 |
Related Weaknesses (CWE)
References
- https://syncope.apache.org/security#CVE-2018-17186:_XXE_on_BPMN_definitionsMitigationVendor Advisory
- https://syncope.apache.org/security#CVE-2018-17186:_XXE_on_BPMN_definitionsMitigationVendor Advisory
FAQ
What is CVE-2018-17186?
CVE-2018-17186 is a vulnerability with a CVSS score of 7.2 (HIGH). An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution.
How severe is CVE-2018-17186?
CVE-2018-17186 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-17186?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Syncope.